Behavioral task
behavioral1
Sample
d1c7f51dbbae0e3931aeebda13db45fe_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
d1c7f51dbbae0e3931aeebda13db45fe_JaffaCakes118
-
Size
388KB
-
MD5
d1c7f51dbbae0e3931aeebda13db45fe
-
SHA1
a31d3f40422fedc0f09e1d5f320a563620aeb71f
-
SHA256
b45c94902da3220e7389d544ae12e4c81260486b3c191f67375d31155a9bbef5
-
SHA512
ce6470717c39192ea9193e0eca409bae6f4aef11216509f5633ea2a1ccafc0d07747203b59fc5bf0a9bb7e63be63c80f7e501740c7b7cd2f1bfa133eb7ab83e8
-
SSDEEP
3072:tMoGlz5upkjyKIB+71ii/WmNpWvaPgMc3PgRGlbxrKwyDk5VSbxv6dOK:tMoM5ue6+71Z/bNpWvaPgigfyDoS
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d1c7f51dbbae0e3931aeebda13db45fe_JaffaCakes118
Files
-
d1c7f51dbbae0e3931aeebda13db45fe_JaffaCakes118.exe windows:5 windows x86 arch:x86
fbf042b0101e22118bc1814a2dd20c0c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
GetLastError
SetLastError
SetFileAttributesA
GetSystemInfo
SetEnvironmentVariableA
GetCurrentDirectoryA
TlsAlloc
CloseHandle
GetTempPathA
CreateMutexA
lstrcatA
GetEnvironmentVariableA
lstrcpyA
WriteFile
ReadFile
GetModuleFileNameA
DeleteFileA
TryEnterCriticalSection
FindNextFileA
GetFileAttributesA
TlsSetValue
InitializeCriticalSection
GetSystemTimeAsFileTime
GetModuleHandleW
CreateDirectoryW
InterlockedDecrement
InterlockedIncrement
lstrlenA
CreateFileA
FindClose
FindFirstFileA
ResumeThread
DeleteTimerQueueTimer
CreateTimerQueueTimer
SetThreadPriority
WaitForSingleObject
SetEvent
Sleep
CreateEventA
lstrcmpiA
OpenEventA
ReleaseMutex
CreateThread
SystemTimeToFileTime
GetSystemTime
PulseEvent
HeapFree
GetProcessHeap
CreateProcessA
CopyFileA
OpenMutexA
ExitProcess
FileTimeToDosDateTime
HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsFree
GetCurrentThreadId
HeapCreate
VirtualFree
DeleteCriticalSection
VirtualAlloc
HeapReAlloc
GetStdHandle
SetHandleCount
GetFileType
LCMapStringW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
LCMapStringA
MultiByteToWideChar
SetFilePointer
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetCurrentProcessId
RtlUnwind
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetTimeZoneInformation
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
CompareStringA
CompareStringW
HeapSize
SetEndOfFile
GetVolumeInformationA
GetSystemDirectoryA
DeviceIoControl
DefineDosDeviceA
QueryDosDeviceA
GetTickCount
GetEnvironmentVariableW
GetVersionExA
GetSystemDefaultLangID
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
lstrcmpA
GetFileSize
user32
wsprintfA
advapi32
RegEnumKeyExA
RegQueryValueExA
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
shell32
ord680
SHGetFolderPathA
SHGetSpecialFolderPathA
ws2_32
ioctlsocket
WSAGetLastError
select
recv
bind
freeaddrinfo
__WSAFDIsSet
closesocket
send
WSAStartup
WSACleanup
listen
accept
inet_addr
htons
WSASocketA
gethostbyname
connect
socket
getaddrinfo
wininet
InternetSetOptionA
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
SysStringLen
Sections
UPX0 Size: 256KB - Virtual size: 256KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE